Merge 142760

Source/WebCore/rendering/RenderLayerModelObject.cpp

Index: Source/WebCore/rendering/RenderLayerModelObject.cpp
===================================================================
--- Source/WebCore/rendering/RenderLayerModelObject.cpp	(revision 145441)
+++ Source/WebCore/rendering/RenderLayerModelObject.cpp	(working copy)
@@ -76,6 +76,16 @@
 
 void RenderLayerModelObject::willBeDestroyed()
 {
+    if (isPositioned()) {
+        // Don't use this->view() because the document's renderView has been set to 0 during destruction.
+        if (Frame* frame = this->frame()) {
+            if (FrameView* frameView = frame->view()) {
+                if (style()->hasViewportConstrainedPosition())
+                    frameView->removeViewportConstrainedObject(this);
+            }
+        }
+    }
+
     // RenderObject::willBeDestroyed calls back to destroyLayer() for layer destruction
     RenderObject::willBeDestroyed();
 }